Overview
overview
3Static
static
3WinLicense2.4.630.zip
windows11-21h2-x64
1Winlicense...ct1.js
windows11-21h2-x64
3Winlicense...m1.ps1
windows11-21h2-x64
3Winlicense...er.vbs
windows11-21h2-x64
1Winlicense...es.vbs
windows11-21h2-x64
1Winlicense...er.vbs
windows11-21h2-x64
1Winlicense...er.vbs
windows11-21h2-x64
1Winlicense...es.vbs
windows11-21h2-x64
1Winlicense...er.vbs
windows11-21h2-x64
1Winlicense...es.vbs
windows11-21h2-x64
1Winlicense...ct1.js
windows11-21h2-x64
3Winlicense...m1.ps1
windows11-21h2-x64
3Winlicense...ct1.js
windows11-21h2-x64
3Winlicense...m1.vbs
windows11-21h2-x64
1Winlicense...m1.vbs
windows11-21h2-x64
1Winlicense...rt.htm
windows11-21h2-x64
1Winlicense...m1.vbs
windows11-21h2-x64
1Winlicense...m1.vbs
windows11-21h2-x64
1Winlicense...rt.htm
windows11-21h2-x64
1Winlicense...er.vbs
windows11-21h2-x64
1Winlicense...es.vbs
windows11-21h2-x64
1Winlicense...er.vbs
windows11-21h2-x64
1Winlicense...es.vbs
windows11-21h2-x64
1Winlicense...on.pdf
windows11-21h2-x64
1Winlicense...vb.vbs
windows11-21h2-x64
1Winlicense...32.dll
windows11-21h2-x64
1Winlicense...64.dll
windows11-21h2-x64
1Winlicense...SDK.js
windows11-21h2-x64
3Winlicense...ol.dll
windows11-21h2-x64
3Winlicense...SDK.js
windows11-21h2-x64
3Winlicense...DK.dll
windows11-21h2-x64
3Winlicense...64.dll
windows11-21h2-x64
1Analysis
-
max time kernel
142s -
max time network
162s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/07/2024, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
WinLicense2.4.630.zip
Resource
win11-20240704-en
Behavioral task
behavioral2
Sample
WinlicenseSDK/ExamplesSDK/SmartActivate Keys/C/CBuilder/Project1.js
Resource
win11-20240704-en
Behavioral task
behavioral3
Sample
WinlicenseSDK/ExamplesSDK/SmartActivate Keys/VB .NET/ExampleSmartKeys/Form1.ps1
Resource
win11-20240704-en
Behavioral task
behavioral4
Sample
WinlicenseSDK/ExamplesSDK/SmartActivate Keys/VB .NET/ExampleSmartKeys/My Project/Resources.Designer.vbs
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
WinlicenseSDK/ExamplesSDK/SmartActivate Keys/VB .NET/ExampleSmartKeys/My Project/Resources.vbs
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
WinlicenseSDK/ExamplesSDK/SmartActivate Keys/VB .NET/ExampleSmartKeys/My Project/Settings.Designer.vbs
Resource
win11-20240704-en
Behavioral task
behavioral7
Sample
WinlicenseSDK/ExamplesSDK/Text Keys Registration/C#/ANSI/WindowsApplication1/Properties/Resources.Designer.vbs
Resource
win11-20240704-en
Behavioral task
behavioral8
Sample
WinlicenseSDK/ExamplesSDK/Text Keys Registration/C#/ANSI/WindowsApplication1/Properties/Resources.vbs
Resource
win11-20240704-en
Behavioral task
behavioral9
Sample
WinlicenseSDK/ExamplesSDK/Text Keys Registration/C#/UNICODE/WindowsApplication1/Properties/Resources.Designer.vbs
Resource
win11-20240704-en
Behavioral task
behavioral10
Sample
WinlicenseSDK/ExamplesSDK/Text Keys Registration/C#/UNICODE/WindowsApplication1/Properties/Resources.vbs
Resource
win11-20240704-en
Behavioral task
behavioral11
Sample
WinlicenseSDK/ExamplesSDK/Text Keys Registration/C/CBuilder/Project1.js
Resource
win11-20240704-en
Behavioral task
behavioral12
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/C# (.NET)/Form1.ps1
Resource
win11-20240704-en
Behavioral task
behavioral13
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/C/CBuilder/Project1.js
Resource
win11-20240704-en
Behavioral task
behavioral14
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/Visual Basic/Visual Basic .NET/Backup/Form1.vbs
Resource
win11-20240704-en
Behavioral task
behavioral15
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/Visual Basic/Visual Basic .NET/Backup/Form1.vbs
Resource
win11-20240704-en
Behavioral task
behavioral16
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/Visual Basic/Visual Basic .NET/Backup/_UpgradeReport.htm
Resource
win11-20240704-en
Behavioral task
behavioral17
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/Visual Basic/Visual Basic .NET/Form1.vbs
Resource
win11-20240704-en
Behavioral task
behavioral18
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/Visual Basic/Visual Basic .NET/Form1.vbs
Resource
win11-20240704-en
Behavioral task
behavioral19
Sample
WinlicenseSDK/ExamplesSDK/Trial-Registration/Visual Basic/Visual Basic .NET/_UpgradeReport.htm
Resource
win11-20240508-en
Behavioral task
behavioral20
Sample
WinlicenseSDK/ExamplesSDK/TrialCustomStrings/C#/ANSI/WindowsApplication1/Properties/Resources.Designer.vbs
Resource
win11-20240704-en
Behavioral task
behavioral21
Sample
WinlicenseSDK/ExamplesSDK/TrialCustomStrings/C#/ANSI/WindowsApplication1/Properties/Resources.vbs
Resource
win11-20240704-en
Behavioral task
behavioral22
Sample
WinlicenseSDK/ExamplesSDK/TrialCustomStrings/C#/UNICODE/WindowsApplication1/Properties/Resources.Designer.vbs
Resource
win11-20240704-en
Behavioral task
behavioral23
Sample
WinlicenseSDK/ExamplesSDK/TrialCustomStrings/C#/UNICODE/WindowsApplication1/Properties/Resources.vbs
Resource
win11-20240704-en
Behavioral task
behavioral24
Sample
WinlicenseSDK/Include/C/Via ASM module/How to add ASM files in your Solution.pdf
Resource
win11-20240508-en
Behavioral task
behavioral25
Sample
WinlicenseSDK/Include/Visual Basic .NET (Helper Functions)/WinLicence.vb.vbs
Resource
win11-20240704-en
Behavioral task
behavioral26
Sample
WinlicenseSDK/SecureEngineSDK32.dll
Resource
win11-20240704-en
Behavioral task
behavioral27
Sample
WinlicenseSDK/SecureEngineSDK64.dll
Resource
win11-20240704-en
Behavioral task
behavioral28
Sample
WinlicenseSDK/WinLicense DLL Control/Examples/Delphi/WDC_SDK.js
Resource
win11-20240704-en
Behavioral task
behavioral29
Sample
WinlicenseSDK/WinLicense DLL Control/Examples/Delphi/WLDLLControl.dll
Resource
win11-20240704-en
Behavioral task
behavioral30
Sample
WinlicenseSDK/WinLicense DLL Control/Include/Delphi/WDC_SDK.js
Resource
win11-20240508-en
Behavioral task
behavioral31
Sample
WinlicenseSDK/WinlicenseSDK.dll
Resource
win11-20240704-en
Behavioral task
behavioral32
Sample
WinlicenseSDK/WinlicenseSDK64.dll
Resource
win11-20240704-en
General
-
Target
WinlicenseSDK/WinlicenseSDK.dll
-
Size
166KB
-
MD5
d90c96dbfa873779f2327cbd35da282d
-
SHA1
aaa6c492095e6889fd8c0c5b6ee1495050846852
-
SHA256
0deabc8f6005df13aec5a2dea3ff99ce7a314eeb4ffce6f6b62dc6bb7df95e4c
-
SHA512
33285349ac47a9ce11c6717c8b2a6138d996fefd8404dfcb24d51b0ebbdc074a04e521f9339d04e01535fff6a7405e6657d16fd161eb47ba83ce4e469fdc8d07
-
SSDEEP
1536:foL/sTIKGV1DvpsOvKkyHgju2grtCsfTPhn+7PoSrNxagnCgPMzjrN/8NEoYpNGU:Q4TUAHIgl50JGRcR7n9fOgCiMBdLv3J
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4128 4336 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1960 wrote to memory of 4336 1960 rundll32.exe 79 PID 1960 wrote to memory of 4336 1960 rundll32.exe 79 PID 1960 wrote to memory of 4336 1960 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WinlicenseSDK\WinlicenseSDK.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\WinlicenseSDK\WinlicenseSDK.dll,#12⤵PID:4336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 4683⤵
- Program crash
PID:4128
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4336 -ip 43361⤵PID:4560